{
 "Event": {
  "uuid": "4da37fa4-4d5d-55ac-a9b1-1036b696dc20",
  "info": "Lazarus Group Cryptocurrency Exchange Heist — Singapore",
  "date": "2026-04-28",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"apt\""
   },
   {
    "name": "misp-galaxy:threat-actor=\"Lazarus Group\""
   },
   {
    "name": "misp-galaxy:country=\"singapore\""
   },
   {
    "name": "misp-galaxy:country=\"south korea\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   },
   {
    "name": "misp-galaxy:sector=\"Cryptocurrency\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/lazarus-group-cryptocurrency-exchange-heist-singapore/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": {
     "title": "FBI Flash Alert",
     "url": "https://www.ic3.gov/"
    },
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": {
     "title": "Chainalysis Reactor Analysis",
     "url": "https://www.chainalysis.com/blog/"
    },
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Lazarus Group (DPRK) executed a sophisticated supply-chain compromise of a cryptocurrency custodial platform based in Singapore, stealing approximately USD 230 million in mixed crypto assets. The attack chain involved compromising a third-party trading SDK used by the exchange, injecting malicious transaction-signing code. FBI and MAS (Monetary Authority of Singapore) issued joint alert. Funds traced through Tornado Cash and cross-chain bridges to DPRK-linked wallets.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}